AI That Hunts Logic Bugs Before Attackers Do - Taylor Luttrell-Williams, Sonar
Sonar's Taylor Luttrell-Williams introduces SonarQube Hunter Agent, an AI security agent that finds intent-level flaws such as broken access control, business logic gaps, and authentication holes that pattern-based SAST cannot detect. The talk covers its multi-agent pipeline with adversarial validation, Sonar's join to the OpenAI Daybreak Cyber Partner Program, and a live demo that surfaced 46 issues in a Python app, including a self-promotion to admin and an MFA bypass.
Why SAST misses intent-level vulnerabilities
Pattern-based SAST is built to find code that matches known bad patterns. It is much less equipped for vulnerabilities where the code is syntactically and functionally valid but the intent behind it is flawed. Examples include broken access control, business logic gaps, and authentication weaknesses. These are logic-level issues that contradict underlying business rules: the code runs as written, but it does the wrong thing.
The timing problem makes this worse. Many companies run penetration tests at most twice a year, or quarterly, while agent-generated code ships at ‘agentic velocity and agentic volume.’ Attackers now have better models, and the window between discovery and weaponization keeps shrinking. Sonar argues that a new class of agents is needed to detect and fix these vulnerabilities before attackers do.
How Hunter Agent works
SonarQube Hunter Agent is an AI security agent that runs as a pipeline over a repository:
- A first agent maps the repository globally.
- Based on that map, three specialized agents run, one per class of issue. They examine relationships between components to infer the security expectations the code should meet.
- Adversarial validation checks each candidate finding to confirm it is real and not a false positive.
- Noise gates suppress low-validity findings and issues that are intentional by design.
The output is a set of high-quality issues, each with a severity, an assessed impact on the codebase, and the exact location where it can be fixed. Issues can be assigned directly to developers. For teams already using SonarQube, these findings appear alongside SAST results in the same interface.
Sonar joins the OpenAI Daybreak Cyber Partner Program
Sonar is joining the OpenAI Daybreak Cyber Partner Program. This gives customers governed access to advanced cybersecurity frontier models inside products like Hunter Agent. The argument is that security teams need frontier-level reasoning to keep pace with attackers. Daybreak-class reasoning deepens each playbook, so findings are precise, repeatable, and auditable. Every lead is investigated and validated before it surfaces.
Layering SAST with Hunter Agent
Sonar recommends running SAST and Hunter Agent together on a single platform for two layers of verification. SAST and software composition analysis (SCA) cover known patterns and dependency risks. Hunter Agent picks up intent-level gaps that pattern matching misses. The design is presented as layered, zero-trust, and independent, with the goal of finding zero-day vulnerabilities consistently.
Demo: scanning a Python application
The demo starts from the SonarQube Cloud dashboard, where a ‘scan now’ button triggers an on-demand scan. Before running, the dashboard estimates the units needed for a deep, whole-codebase reasoning pass. The same workflow works with SonarQube Cloud or the self-hosted SonarQube Server. Depending on project size and complexity, a scan can take more than an hour.
A scan runs in stages. It securely clones the repository, analyzes the architecture to map attack surfaces and build a threat model, and runs deep contextual scans for IDOR, broken access control, and business logic flaws. It then aggregates and deduplicates findings from all the specialized sub-agents into one issue list and exports the validated vulnerabilities into SonarQube’s issue list.
The scan in the demo produced 46 open issues across three categories:
- Broken access control: insecure direct object references (IDOR), missing or incorrect authorization checks, privilege escalation, sensitive data exposure, and cross-site request forgery.
- Business logic: skipping required workflow steps, abusing repeatable actions, and missing rate limits. The demo project had five of these findings.
- Authentication and session: session fixation, non-expiring sessions, weak password recovery, missing multi-factor authentication (MFA), and brute-force gaps.
One high-severity access control finding showed that any signed-in user could pass the admin access check because they could write their own role field, effectively promoting themselves to admin. Each issue shows where it occurs in the code, why it is a problem, how to fix it, and an activity thread for discussion. Issues start in an open state. Developers can accept an issue, which marks it valid without affecting the quality gate, confirm it, which marks it valid and lets it affect the quality gate and block the release, or mark it a false positive if they believe the suggested fix is wrong.
A second high-severity finding showed that a user with only a password could reach every protected route, including admin functions, without completing MFA.
Scheduled scans and automatic remediation
Hunter Agent can run on demand or on a schedule. Teams can set a daily, weekly, or monthly cadence and choose a specific branch, with the main branch as the default in the demo.
For business logic issues, Hunter Agent suggests fixes. Sonar also announced that these issues can now be assigned to the SonarQube remediation agent, which applies fixes automatically and can run on a schedule. The goal is to catch logic-level vulnerabilities before anyone else does.